From 50fea6d1a34aed258fed1ff348676988e687b3cf Mon Sep 17 00:00:00 2001 From: "randomizedcoder dave.seddon.ca@gmail.com" Date: Mon, 20 Jul 2026 14:17:24 -0700 Subject: [PATCH 1/2] web: avoid aliasing cert.DNSNames when building the SAN list gocritic's appendAssign check flags append(cert.DNSNames, cert.EmailAddresses...): appending to cert.DNSNames mutates its backing array when it has spare capacity, which could surprise a caller still holding the certificate. slices.Concat always allocates a fresh slice, which is the intent here. No functional change; slices is already imported. Co-Authored-By: Claude Opus 4.8 Signed-off-by: randomizedcoder dave.seddon.ca@gmail.com --- web/tls_config.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/web/tls_config.go b/web/tls_config.go index 7245f741..2cdaef09 100644 --- a/web/tls_config.go +++ b/web/tls_config.go @@ -106,7 +106,7 @@ func (t *TLSConfig) VerifyPeerCertificate(rawCerts [][]byte, _ [][]*x509.Certifi } // Build up a slice of strings with all Subject Alternate Name values - sanValues := append(cert.DNSNames, cert.EmailAddresses...) + sanValues := slices.Concat(cert.DNSNames, cert.EmailAddresses) for _, ip := range cert.IPAddresses { sanValues = append(sanValues, ip.String()) From a803e6b3cc99fd4117818d9dd98181553d1d3c94 Mon Sep 17 00:00:00 2001 From: "randomizedcoder dave.seddon.ca@gmail.com" Date: Mon, 20 Jul 2026 14:17:24 -0700 Subject: [PATCH 2/2] lint: enable govet (all) and a set of correctness linters Mirrors prometheus/blackbox_exporter#1631. Enables copyloopvar, durationcheck, gocritic, makezero, unconvert, and wastedassign, plus govet enable-all (minus fieldalignment and shadow, which are noisy / idiomatic in this codebase). These are low-noise correctness checks; after the preceding appendAssign fix there are no findings on the tree. golangci-lint run ./... is clean, and go build / go test ./... pass. Co-Authored-By: Claude Opus 4.8 Signed-off-by: randomizedcoder dave.seddon.ca@gmail.com --- .golangci.yml | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/.golangci.yml b/.golangci.yml index d5075d45..192eaa26 100644 --- a/.golangci.yml +++ b/.golangci.yml @@ -6,6 +6,13 @@ linters: - misspell - modernize - revive + # Correctness linters (low-noise, no findings on the current tree). + - copyloopvar + - durationcheck + - gocritic + - makezero + - unconvert + - wastedassign exclusions: generated: strict presets: @@ -23,6 +30,13 @@ linters: exclude-functions: # Used in HTTP handlers, any error is handled by the server itself. - (net/http.ResponseWriter).Write + govet: + enable-all: true + disable: + # Struct field ordering is not worth the churn/readability cost. + - fieldalignment + # err shadowing is idiomatic and used throughout the codebase. + - shadow revive: rules: # https://github.com/mgechev/revive/blob/master/RULES_DESCRIPTIONS.md#unused-parameter